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Abstract 

We investigate the delay limited secrecy capacity of the flat fading channel under two different assumptions on 
the available transmitter channel state information (CSI). The first scenario assumes perfect prior knowledge of both 
the main and eavesdropper channel gains. Here, upper and lower bounds on the delay limited secrecy capacity are 
derived, and shown to be tight in the high signal-to-noise ratio (SNR) regime. In the second scenario, only the main 
channel CSI is assumed to be available at the transmitter where, remarkably, we establish the achievability of a 
non-zero delay-limited secure rate, for a wide class of channel distributions, with a high probability. In the two cases, 
our achievability arguments are based on a novel two-stage key-sharing approach that overcomes the secrecy outage 
phenomenon observed in earlier works. 

I. Introduction 

Many wireless applications are limited by different forms of delay constraints. These applications range from 
the most basic voice communication to the more demanding multimedia streaming. However, due to its broadcast 
nature, the wireless channel is vulnerable to eavesdropping and other security threats. Therefore, techniques that 
satisfy both the delay limitation and the confidentiality requirement are of definite interest. This motivates our 
analysis of the fundamental (information theoretic) limits of secure communication over fading channels subject to 
strict deadlines. 

Recent works on information theoretic security have been largely inspired by the wire-tap channel model of 
Wyner [1]. In this seminal work, Wyner established the achievability of non-zero secrecy capacity when the 
wiretapper channel is a degraded version of the main one, by exploiting the noise to create an advantage for 
the legitimate receiver. More recently, the effect of fading on the secrecy capacity was studied in [2] in the ergodic 
setting. The main insight offered by this work is the achievability of a non-zero secrecy capacity, by opportunistically 
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exploiting the multi-path channel fluctuations, even when the eavesdropper channel is better than the legitimate one 
on the average. 

On the other side, delay limited transmission over fading channels has been well studied in different network 
settings and using various traffic models. For example, in [3], the delay limited capacity notion was introduced 
and the optimal power control policies were characterized in several interesting scenarios. In [4], the strict delay 
limitation of [3] was relaxed by allowing for buffering the packets at the transmitter. In this setup, the asymptotic 
behavior of the power-delay trade-off curve was characterized yielding valuable insights on the structure of the 
optimal resource allocation strategies [4]. More recently, the scheduling problem of data transmission over a finite 
delay horizon assuming perfect CSI was considered in [5]. Our work can be viewed as a generalization of [3] 
whereby a secrecy constraint is imposed on the problem. 

The delay limited transmission of secure data over fading channels was considered previously in [6]. In that 
work, the authors attempted to send the secure information using binning techniques inspired by the wiretap channel 
results. The drawback of this approach is that it fails to secure the information in the particular instants where the 
eavesdropper channel gain is larger than that of the main channel. This results in the so-called secrecy outage 
phenomenon (as defined in [6]). Unfortunately, in the delay limited setting, the secrecy outage can not be made to 
vanish by increasing the transmission power, since it does not offer a relative advantage to the legitimate receiver, 
leading to the conclusion that the delay limited secure rate achieved by this approach is equal to zero for most 
channel distributions of interest [6]. This obstacle is overcome by our two-stage approach. Here, the delay sensitive 
data is secured via Vernam's one time pad approach [7] (see also [8]) using a private key, which was shared secretly 
by the two legitimate nodes during previous transmissions. Since the key packets are not delay sensitive, the two 
nodes can share the key by distributing its bits over many fading realizations to capitalize on the ergodic behavior 
of the channel. Our result is enabled by observing that, through the appropriate rate allocation, the key bits can 
be superimposed on the delay sensitive data packets so that they can be used for securing future packets. This 
mechanism is referred as key renewal process in the sequel. This process requires an initialization phase to share 
the key needed for securing the first data packets. However, the loss in throughput entailed by the initialization 
overhead vanishes in the asymptotic limit of a large number of data packets. Our analytical results establish the 
asymptotic optimality, with high SNR, of this novel approach in the scenario where both the main and eavesdropper 
channel gains are known a-priori at the transmitter. When only the main channel CSI is available, this approach is 
shown to achieve a non-zero constant secure rate for a wide class of quasi-static and invertible channels [3] with 
high probability l . 

The rest of the paper is organized as follows. Section II introduces the system model and notations used throughout 
the paper. Section III focuses on the full CSI scenario whereas the case with only the main channel CSI is analyzed 
in Section IV; along with some representative numerical results. Finally, some concluding remarks are offered in 

'We use a modified version of the e-achievable rate defined in [9] to argue that our results are achievable with a vanishing probability of 
secrecy outage. 
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Section V. 

II. System Model 

The system model is shown in Figure 1. A source node (Alice) wishes to communicate with a destination node 
(Bob) over a fading channel in the presence of an eavesdropper (Eve). We adopt a block fading model, in which the 
channel is assumed to be constant during a coherence interval and changes randomly from an interval to the next 
according to a bounded continuous distribution. Also, the coherence intervals are assumed to be large enough to 
allow for the use of random coding arguments. During any symbol interval i, the signals received at the destination 
and the eavesdropper, respectively, are given by 

y(i) = 9m(i)x(i) +w m (i), (1) 

z(i) = g e (i)x(i) +w e (i), (2) 

where x(i) is the transmitted symbol, g m (i) and g e (i) are the main channel and the eavesdropper channel gains 
respectively, w m (i) and w e (i) are the i.i.d. additive white complex gaussian noise with unit variance at the legitimate 
receiver and the eavesdropper, respectively. We denote the power gains of the fading channels for the main and 
eavesdropper channels by h m (i) = \g m {i)\ 2 and h e (i) — \g e (i)\ 2 , respectively. We impose the long term average 
power constraint P, i.e., 

E[P(h)] < P, (3) 

where P(h) is the power allocated for the channel state h = (h m ,h e ) and the expectation is over the channel 
gains. 

The source wishes to send a message W E W = {1, 2, • • • , M} to the destination while satisfying the delay and 
secrecy constraints. In the following, our delay constraint is imposed by breaking our message into packets of equal 
sizes, where each one is encoded independently, transmitted in only one coherence block, and decoded by the main 
receiver at the end of this block. The total transmission time of n channel symbol durations is divided into coherence 
intervals of length n' channel uses; for which both h m and h e remain fixed. We assume there are total of SB 
number of such fading blocks. These blocks are grouped into S super-blocks, each consisting of B fading blocks. 
We will further represent a fading block with tuple (s, b) such that s E {1, 2, • • • , S} denotes the super-block index 
and b E {1, 2, • • ■ ,B} denotes the fading block index within a particular super-block. We consider the problem of 
constructing (M',n') codes (M — SB M') to transmit the message of the block (s,b), which is represented by 
W(s, b) e W = {1, 2, . . . , M'}, to the receiver. Here, an (M\ n') code consists of the following elements: 1) a 
stochastic encoder /„'(.) at the source that maps the message w(s,b) to a codeword X n (s,b) E X n , and 2) a 
decoding function <p: y n — ► W at the legitimate receiver, where n* = (s — l)Bn' + bn' denotes the total number 
of the received signal dimension at the receiver at the end of the block (s, b). The average error probability of an 
(M',n r ) code is defined as 

P?'(s,b) = ^7 E Pr ({^(y"*) w\w is sent in block (s,b)}) , 

wEW 
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where y n represents the total received signals at the legitimate receiver at the end of the block (s, b). We define the 
equivocation rate R e at the eavesdropper as the entropy rate of the transmitted message over block (s, b) conditioned 
on the available CSI and all the channel outputs at the eavesdropper, i.e., 

R e (s, b) ± ±jH(W(s, b)\Z\ /C, K), (4) 
n 

where = {h m (l), ■ ■ ■ , h m (n)} and h™ = {h e (l), ■ ■ ■ , h e (n)} denote the channel power gains of the legitimate 
receiver and the eavesdropper in n symbol intervals, respectively. We consider only the perfect secrecy (in the sense 
of [1]) which requires the equivocation rate R e to be arbitrarily close to the message rate. Hence, we define the 
achievability of the delay limited secrecy rate and capacity, respectively, as follows. 

Definition 1: The rate R sd is said to be an achievable delay limited secrecy rate, if for any e' > 0, there exist 
a (2 n ' R °- d ,n r ) code such that 

Pf(s,b) < e', 

R e (s,b) > R S M-e' (5) 

for every fading block (s, b), s ^ 1, and for sufficiently large n, B. The delay limited secrecy capacity, C s ,d, is 
defined as the supremum of the achievable delay limited perfect secrecy rates. 

Here, if the secrecy constraint (5) is not satisfied for a given block, then the corresponding block is said to be 
in secrecy outage, the probability of which is defined as follows. 

Definition 2: For a given e' > 0, the probability of secrecy outage for the block (s, b) evaluated at rate R s d is 
given by 

Ponds, b, R s4 , e') 4 Pr ({R e ( s , b) < R s4 - e'}) . (6) 

Now, we define a modified version of the e-achievable rate notion given by [9] (see also [10]) for the secrecy 
outage phenomenon. 

Definition 3: The rate R s ^{e) is said to be an e-achievable delay limited secrecy rate, if for any e' > 0, there 
exists a (2 n> Rs - d( - e \n') code such that 

Pf( s ,b) < e' 

Pout(s,b,R s , d {e),e') < e (7) 

for every fading block (s,b), s^l, and for sufficiently large n, B. The e-delay limited secrecy capacity, C s ^(e), 
is defined as the supremum of the achievable delay limited secrecy rates with secrecy outage probability less than 
e. 

We note that in our achievability results, an initialization phase occurs during the first super-fading block (s = 1), 
and its duration is negligible as S — > oo. This explains why the requirements of Definitions 1 and 3 are satisfied 
for every fading block (s, b) with s ^ 1. 

Finally, we give some notational remarks. We denote the delay limited secrecy rate and capacity as Rf d , C^ d , 
respectively, for the full CSI scenario, where both g m and g e are known a-priori at the transmitter. For the main 
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CSI scenario, where only g m is known a-priori at the transmitter, the delay limited secrecy rate, secrecy capacity, 
e-achievable secrecy rate, and e-secrecy capacity, are denoted respectively by Rf d , C^ d , Rf d {t) and Cj^(e). We 
let [x] + = max{x, 0}. log(-) denotes the base-2 logarithm. Throughout the sequel, the expectations are taken with 
respect to the random channel gains. 

III. Full Transmitter CSI 

First, we give a simple upper bound on the delay limited secrecy capacity. This bound will be used to establish 
the optimality of the proposed two-stage approach in the high SNR regime. 

Theorem 1: The delay limited secrecy capacity when both g m and g e are available at the transmitter, C^ d , is 
upper bounded by 

Cl d < max min {flf.itf}, (8) 

s.t. E[P(h)]<P 

where Rf and Rf are given as follows. 

Rf = E[log(l + P(h)M-log(l + P(h)M] + 
Rf = minlog(l + P(h)^ m ) 

h 

Proof: Consider an arbitrary power allocation scheme P(h). Since imposing delay constraint can only degrade 
the performance, we upper bound the achievable delay limited secrecy rate with the ergodic secrecy rate as 

We also have 

Kd < (10) 

since imposing the secrecy constraint can not increase the achievable rate. Then, combining (9) and (10), and 
maximizing over P(h), we obtain 

Rf d <m^min{Rf, Rf}, (11) 

which proves our claim. ■ 
The following result establishes a lower bound on the delay limited secrecy capacity using our novel two- 
stage approach. The key idea is to share a private key between Alice and Bob, without being constrained by the 
delay limitation. This key is, then, used to secure the delay sensitive data while overcoming the secrecy outage 
phenomenon. In the steady state, the key renewal process takes place by superimposing the key on the delay 
sensitive traffic. More precisely, as outlined in the proof, the delay sensitive traffic (secured by the previously 
shared key) serves as a randomization signal in the binning scheme used to secure the current key. Finally, since h e 
is known a-priori at the transmitter, one can further increase the delay limited secrecy rate by dedicating a portion 
of the secure rate to the delay sensitive traffic (as controlled by the function g(h) in the following theorem). 
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Theorem 2: The delay limited secrecy capacity in the full CSI scenario, C^ d , is lower bounded by the following 
achievable rate. 



Cfj > Rfj = max 

s,a — s,a p(h) ?(h) 

s.t. E[P(h)]<P 



min{i? 1 (h) + i? 2 (h)} 

h 



(12) 



where 



R s (h) = [log(l + P(h)/ lm )-log(l + P(h)/i e )] + , 

R k (h) = [log(l + P(h)/ lm )-log(l + P(h) g (h))] + , (13) 
P 2 (h) = R s (h) - R k (h), 
q(h) > h e , Vh e , and Pi(h) is chosen to satisfy the following 

E[i2i(h)] < E[R k (h)} 

JJi(h) < min{log(l + P(h)/i ro ),log(l + P(h)/i e )} (14) 

Proof: Consider a fixed pair (h m , h e ), a power control policy P(h) satisfying P[P(h)] < P, and an arbitrary 
function q(-) such that q(h) > h e . The achievable rate is obtained by finding the minimum rate over the pair 
(h m ,h e ), to satisfy our strict delay constraint, and then maximizing over all power control policies and functions 
q(h). We start the proof by defining the different rates in (12), (13), (14): R s (h) is the instantaneous secrecy rate 
supported by the channel, Pfe(h) is the rate used to share the private key, P 2 (h) is the delay limited secrecy rate 
of the data that is transmitted without the key, and Pi(h) is the rate of the data sent via the one time pad scheme. 
Moreover, we define the additional randomization rate by 

P x (h) = min{log(l + P(h)/i m ),log(l + P(h)h e )} - Pi(h) (15) 

Our Two-stage Scheme: We divide the message W e W = {1,2, •• ■ ,2 nR ^} into (S - 1)5 data packets 
D(s, b), each encoded independently and sent with rate Rf d during the block of the channel where s e {2, • • • , S} 
and b S {1, 2, • • • , B}. We further divide each data packet into two parts: D\ (s, b) which is sent as an open message 
(after being encrypted by the key) and D 2 (s, b) which is sent as a secure message. Our scheme uses a separation 
strategy similar to [11] by sending public and private messages simultaneously. But in contrast to [11], we exploit 
the fading channel to secure the key, and hence, the message. We now describe the initial key generation and key 
renewal processes. For the very first B blocks (the super-block s = 1), we generate random key bits, K(l), and 
then transmit them from Alice to Bob securely. Utilizing the ergodicity of the channel, we can transmit a key of 
an approximate length n'BE[Rk(h)] bits [2]. Then, for any super-block s > 1, we will use the key K(s — 1) for 
the one time pad, and also generate a new key K{s) for the use in the next super-block. Here, to secure the open 
packet of block (s, b), we use n'Pi(h) bits from the remaining bits of the key K(s — 1), represented by K(s, b), 
to encrypt the data packet L>i(s, b) using one time pad encryption: 

Di(s, b) = D 1 (s,b)®K(s,b). (16) 
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The encoder will declare an encoding error, if there are not sufficient key bits left in K(s — 1) for the one time 
pad encryption. To summarize, during the block (s,b), four messages are combined together and sent over the 
channel: 

1) Di(s,6) is mapped into Wi(s,6) e Wi = {1,2, ••• ,2 n ' Rl( M}. 

2) D 2 (s, b) is mapped into W 2 (s, b) e W 2 = {1, 2, • • • , 2™'' R2 ( h )}. 

3) The key bits L> fe (s, 6) are mapped into W k (s, b) e W fe = {1, 2, • • • , 2™'^( h )}. 

4) Additional randomization is mapped into W x (s, 6) e W x = {1, 2, • • ■ , 2 n ' R * ( - h )}. 

Codebook Generation and Encoding: Our random coding arguments rely on an ensemble of codebooks 
generated according to a zero-mean Gaussain distribution with variance P(h). If there are enough number of 
key bits for the one time pad scheme (i.e., no encoding error), the encoder will work as follows. For a given 
block (s,b), let R = log(l + P(h)h m (s,b)) - e. When h m (s,b) < h e (s,b), we have one of 2"'( i M h )+ ii *( h )) 
open messages, denoted by the pair (wi,w x ), to be sent. To encode the message (wi,w x ), the encoder selects the 
codeword X n (w\,w x ) from the chosen codebook. On the other hand, when h m (s, b) > h e (s, b), a binning scheme 
(see, e.g., [1]) is used to send secret bits over the channel. We first generate a Gaussian codebook consisting of 
2 n ' R codewords, represented by X n> , and then independently assign each of them to one of 2 n '( Rk( - h ^ +R2 ( h ^ bins, 
where the bin index is (wk,w 2 ), according to a uniform distribution. This ensures that any of the sequences are 
equally likely to be within any of the bins. Each bin has 2" (#i( h )+-R*( h )) sequences with codeword index denoted 
by (wi,w x ). Accordingly, a sequence is represented by the tuple of indices (wk,w 2 , w\,w x ).To encode a particular 
key-message pair, the encoder chooses a codeword indexed by (wi,w x ) from the bin indexed by (wk,w 2 ), i.e., 
X n ' (w k , w 2 , W\, w x ), and send it over the channel. We note that w x is uniformly chosen among W x and W\ is 
determined by the data Di(s,b) and the corresponding key bits of the previous super-block K(s,b), and hence 
uniformly distributed over W\. 

Error Analysis: For each fading block (s,b), we denote the encoding and decoding error events by E enc (s,b) 
and Ed ec (s, b), respectively. Then, we write the error probability at the receiver as follows. 



Since we only impose a constraint on E[i?i(h)] in (14), there will be a non-zero probability that the key bits 
fall short. In such a case the encoder will declare an error. Hence, we can write the following bound. 



Here, from the strong law of large numbers and from (14), we see that the right hand side of (18) and hence 
P*{E enc (s, b)} can be arbitrarily made small as B — > oo. 

Now, it remains to show that Pr{E^ c (s 7 b)\E£ nc (s,b)} can be arbitrarily made small. This follows as n' — > oo, 
by applying the asymptotic equipartition property and jointly typical decoding [12]. In particular, for h m (s,b) < 
h e (s, b), the messages w\ and w x ; and for h m (s, b) > h e (s 7 b), the messages w\, w x , w k , and w 2 can be transmitted 
reliably. Furthermore, as B — > oo, the average key rate E[i?fe(h)] is achievable within any super-block [2]. 



P?'(s, b) = Pr{£ enc ( S , b)} + Pr{i? dec ( S , 6)|£ e c nc ( S , b)} 



(17) 
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Equivocation Computation: Here, we show that the secrecy condition given by (5) is satisfied for each fading 
block (s, b), s > 1. We can write 

n'R e (s,b) ( = } H{D 1 {s,b),D 2 {s,b)\Z n ,h n m ,h n e ) 

= H(D 1 (s,b),D 2 ( S ,b)\Z n ' (1,1), Z n '(l,2),-.. ,Z n \s,b),h n m ,h n e ) 
( => HiD^s, b), D 2 (s, b)\Z n '(s, b),Z Bn '(s - l),h n m , h n e ) 
= H(D 2 (s, b)\Z n '(s, b), Z Bn '(s - l),h n m , h n e ) 

+ H(D 1 (s, b)\D 2 (s, b), Z n '( S , b), Z Bn '(s - 1), h n m , h n e ) (19) 

where Z Bn ' (s- 1) = Z n '(s- 1, 1), Z n '(s- 1, 2), • • • , Z n ' (s- 1, B) is the output of the channel at the eavesdropper 
in the previous super-block s — 1, (a) follows from splitting the data D(s, b) into the two parts Di(s, b) and D 2 (s, b), 
and (b) follows from the independence between block (s, b) and other received signals at the eavesdropper. We now 
focus on the first term in (19). We note that, in the case where h m < h e , no secret bits are sent and hence the first 
term is zero. When h m > h e , in addition to W x (s, b), we use the data Di(s, b) as a randomization signal to secure 
the messages D 2 (s, b) and Dk(s, b). In this case, the first term in (19) can be lower bounded by the following two 
steps. First, 

IjH(D 2 (s, b), D k (s, b)\Z n '(s, b), Z Bn '(s - l),h n m , h n e ) ( = } ^H(D 2 (s, b),D k (s, b)\Z n ' (s, b),h n m , h n e ) 

(*>) 1 

> -H(D 2 (s,b),D k (s,b))-e 

TV 

( = } ^H(D 2 (s,b)) + H(D k (s,b))-e (20) 

TV 

where (a) follows from the independence of (D 2 (s, b), D k (s, b)) and the previous super-block, (b) is a result of using 
the scheme in [2] and the results of [1], i.e., the secrecy of D 2 (s, b) and D k (s, b), along with the appropriate choice 
of the randomization rate such that Ri(h) + R x (h) = I(X(s, b); Z(s, b)) and (c) follows from the independence 
of D 2 (s,b) and D k (s,b). Second, from (20), we have 

±j(H(D 2 \Z n ', Z Bn '(s - 1), h n m , K) + H(D k \D 2 , Z n ',Z Bn '(s - 1), h n m , h n e )) > ^jH(D 2 ) + ^H(D k ) - e, 
implying 

^H(D 2 \Z n ', Z Bn '(s - 1), h n m , K) > ^H(D 2 ) + lj(D fc ; D 2 , Z n ',Z Bn '(s - l),h n m , h n e ) - e 

> ±H(D 2 )-e (21) 

where we have dropped the index (s, b) for simplicity of notation and the last inequality follows from the fact that 
mutual information is non-negative. 
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The second term in (19) is lower bounded as 

-^I{Dv,Z n \D 2 \Z Bn \s-l),h n m ,K) 



- -I(D U Z n \Z Bn (s - 1), D 2 , h n m , h n e ) (22) 



n 



since D\ is independent of Z Bn (s — 1) and Z? 2 - The second term in (22) is upper bounded as 



V(£i; Z n '\Z Bn '(s - 1),D 2 , h n m , h n e ) < -,I{b x -Z n \D x \Z Bn \s - 1), £> 2) /£) 



n' n 

1 



- ^H(D 1 \Z n ',D 1 , Z Bn \s - l),D 2 , h n m , K) 
( = } ^H{D^\Z Bn '{ 8 -l),h^) 

-^H{b x \D^Z Bn \ S -\)^hZ) 

= ^ l I{b 1 -D 1 \Z Bn \s-l),h n m ,h n e ) 

= iff (^^"'(s-l), 
n 

-iff^D^"' (*-!),/«) 
= ^HiD^KlZ^'is-l^h^K) 

-^H{k\b u z Bn '{ s -i),h n m ,K) 

< ^HipiQk) - ±H(k\D u Z Bn '(8 - l),h n ml h n e ) 



n' n' 
( => R^)-^H{K\Z Bn '{s-l),h n m ,h n e ) (23) 

where (a) follows from the conditional independence of Z)i on Z n and D 2 given Z?i and Z Bn (s — 1), (b) follows 
from the fact that conditioning does not increase entropy, and (c) follows from the uniform distribution of K and 
the independence of K and D\ given Z Bn (s — 1). 

Using the same argument as in (20) and (21), and from (18), it is straightforward to see 

±jH(k\Z Bn '(s-l),h n m ,h:) > ljH{K)-e 



= Ri(h)-e. (24) 



Substituting this in (23) and (22), we get 



^H{b x \D 2 ,Z n \z Bn \s-\\h n m ,K) > lff(Di)- C (25) 
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Jim Cf 4 = E hm>he 

P^oo 



log 



(26) 



Finally, combining (19), (21), and (25) completes the proof. ■ 

In the previous result, the achievable rate satisfies the requirements given by the Definition 1 . Consequently, the 
outage probability is zero with the proposed scheme. We also remark that, with the above achievability scheme, the 
initialization phase is over the first super-block, during which the data is not transmitted. With a simple modification, 
the data can also be transmitted during the first super-block by sacrificing the security of only the corresponding 
packets, which is negligibly small compared to the whole message. 

The final step in this section is to establish the asymptotic optimality of the proposed security scheme in the 
high SNR regime. The following result achieves this objective by showing that the upper and lower bounds of 
Theorems 1 and 2 match in this asymptotic scenario for a wide class of invertible channels. 

Lemma 3: In an asymptotic regime of high SNR, i.e., P — > oo, the delay limited secrecy capacity is given by 

hrr 
h e 

is finite. Moreover, the capacity is achieved by the proposed one-time pad encryption 
scheme coupled with the key renewal process. 

Proof: We only need to consider the lower bound as the right hand side of (26) is the ergodic secrecy capacity 
in the high SNR regime, which is by definition an upper bound on the delay limited secrecy capacity. To this end, 
in the proposed scheme, we set q(h) — h e resulting in R^{h) = 0. Furthermore, we let P(h) = min ^ h ^ , where 
c is a constant, which is chosen according to the average power constraint. The achievable rate expression in the 
high SNR regime is then given by 

lim Rf d = lim mini?i(h), (27) 

P^oo ' P^oo h 

where Ri(h) is chosen to satisfy 

E[fli (h)] < E [[log(l + P(h)h m ) - log(l + P(h)h e )}+] 

fli(h) < log(l + c) (28) 

is finite, implying that the second constraint in 



assuming that E 



l 

min(/i e ,/i m ) 



As P — ► oo, it is easy to see that c — > oo since E 
!8) is loose. Also, it is easy to see that t 
by choosing i?i(h) = E hm>he log 



min(/i e ,h m ) 

(28) is loose. Also, it is easy to see that the first constraint converges to the right hand side of the lemma. Then, 

, both constraints of (28) are satisfied and hence the result is proved. ■ 



IV. Only Main Channel CSI 

In this section we assume that only the legitimate receiver CSI is available at the transmitter. First, we have the 
following upper bound. 

Theorem 4: The delay limited secrecy capacity when only the legitimate receiver channel state is available at 
the transmitter, C^ d , is upper bounded by 

C s M d < max min {R?,R?} (29) 

S.t. K[P(h m )]<P 
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where Rf and Rf are given as follows. 

Rf = E[\og(l + P(h m )h m )-\og(l + P(h m )h e )} + 
Rf = minlog(l + P(h m )h m ) 

Proof: The proof follows the same argument as that of Theorem 1 with the power control policy P(h m ). ■ 
The achievability scheme in this scenario is different from the previous scenario in two key aspects: 1) the lack 
of knowledge about h e forces us to secure the whole delay sensitive traffic with the one time pad approach (i.e., 
setting the rate i?2(h) to zero) and 2) the binning scheme of the key renewal process must now operate on the 
level of the super-block to average-out the fluctuations in h e . On the other hand, the delay sensitive packet must 
be decoded after each block. This makes the use of the delay sensitive packet as a randomization signal a rather 
challenging task. Therefore, the achievable rate reported in the following result is obtained by superimposing the 
binning scheme (used to secure the key) on the delay limited traffic (secured by the key bits sent in the previous 
super-block). 

Theorem 5: For any given arbitrarily small e, the e-delay limited secrecy capacity in the only main CSI scenario, 
Cf d (e), is lower bounded by the following e-achievable rate. 

C s M d (e) > Rf d (e) = max min j R s , Rf j , (30) 

s.t. E[P(fc m )]<P 

where 

R s = E[log{l + P{h m )h m )-Rf d (e)-log{l + P{h m )h e )]+, (31) 
Rf = min log(l + P(h m )h m ). (32) 

l>"m 

Proof: First, fix a power control policy P(h m ). The achievable rate is then obtained by maximizing over all 
power control policies satisfying the average power constraint. We start by describing our scheme. We divide the 
channel uses into super-blocks and further divide each super-block into blocks such that the coherence interval is n' 
symbols as considered in the proof of Theorem 2. In this scenario, we utilize the achievable secrecy rate within a 
block only for the key generation. That is, data is transmitted only by using the one-time pad encryption in contrast 
to the scheme used in Theorem 2. Due to the lack of knowledge of h e , the key is decoded at the end of each 
super-block whereas the data packets are still decoded block by block using the key sent in the previous super-block. 
A given message W G {1, 2, • • • , 2 nR "< d ^}, is divided into (S — 1) B data packets, each represented by D(s, b) 
for s E {2, • • • , S} and b 6 {1, • • • , B}, where each packet is sent with rate Rf d {e) during the corresponding 
block of the channel. The data packet D(s, b) is transmitted along with the generated key using the one-time pad 
scheme. Initial key generation and key renewal is similar to the scheme in Theorem 2. We remark that, similar to 
Theorem 2, the initialization phase duration becomes negligible as S — > oo. 

Codebook Generation and Encoding: Let R = mm{i? s , Rf }. For any given block (s,b), s > 1, we use the 
n'R remaining bits from the key K(s — 1) and denote corresponding bits as K(s, b). These bits are used in a 
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one-time pad scheme to construct 

D(s,b)=D(s,b)®K(s,b) (33) 

The encrypted bits are then mapped to a message w(s, b) G {1, 2, • • • , 2™ R }. For the key renewal process, the 
binning scheme is constructed over the super block s, as in the achievable scheme used in [2], such that the output 
bits of the encoder are divided into B independent blocks each consists of n' [log(l + P(h m (s, b))h m (s, b)) — R — e\ 
bits where b € {1, 2, • • • , B} is the coherence interval. We then combine those bits with the n'R reserved bits 
for the encrypted data packet and encode them using a member of the generated Gaussian codebook ensemble, 
which has 2" l io s( 1 +h m (sM)P{h m (sM)))-e] coc j eworc i s . The channel input, denoted by X n (s, b), corresponding to the 
message from the code is sent from the transmitter. 

Error Analysis: Each codeword is decoded at the end of the block releasing the delay sensitive packet. Following 
the same argument used in proof of Theorem 2, P™ (s, b) can be made arbitrarily small as n' — > oo for each (s, b). 
The key bits are decoded at the end of the binning codeword (i.e., super block) following the same argument used 
in [2]. Therefore, as n' — > oo and B — > oo, the proposed key rate is achievable, where the encrypted data bits are 
not used as a part of the randomization message. 

Equivocation Computation: We will show that, for the given e (can be arbitrarily small) and for any given 
e' > 0, 

Pout(s,b,R s . d (e),e') < e 
with the proposed scheme. The equivocation per block for arbitrary chosen block (s, b) is given by 



n'R e (s, b) 



H{D( S ,b)\Z n ,h n m ,h n e ) 



(a) 



H(D 
H(D 
H(D 
H(D 

> H(D 
= H(D 

H(D 

= H{b 

= H(D 

> H(D 
^ H(D 



(c) 



Z n (l,l),Z n (1,2),-. -,Z n (S,B),hl,K) 
Z n '( S ,b),Z Bn '(s-l),h^h n e ) 

z Bn '(s -i),h n m ,K)-i{D- z n '\z Bn \ s - 1), /c, K) 

h^K)-I(D;Z n '\Z Bn '( S -l),h n m ,h?) 
h n m , K) - I(D; Z n ',D\Z Bn '(s - 1), h n m , K) 

/C, K) - H(D\Z Bn \s - 1), /C, K) + H(D\Z n ',D, Z Bn '(s - 1), fc» , h n e ) 
h n m , K) H(D\Z Bn '(s 1), h n m , K) + H(D\D, Z Bn '(s - 1), ft" , h n e ) 

h n m ,K)-i{b-.D\z Bn \ s -i),h n m ,h n e ) 

h n m , h n e ) H{D\Z Bn '(s l),h^, h n e ) + H(D\D, Z Bn '(s 1), h n m , h n e ) 

h n ml K) - H(b ®k) + h(k\d, z BW ( S - 1), /c, K) 
h n m , h n e ) - H(b ®k) + H(K\z Bn \ s - 1), h n m , K) 



(34) 
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where Z Bn ' (s - 1) = Z n ' (s - 1, 1), Z n ' (s - 1,2), • ■ • , Z"'(s - 1, B) is the output of the channel in the previous 
super-block s — 1, the index (s, 6) is omitted in £)(s, b) and (s, 6), (a) follows from the independence between 
block (s, b) and other transmissions, (b) follows from the independence of D and Z Bn (s — 1), (c) follows from 
the independence between D and Z n given D and Z Bn (s — 1), and (d) follows from the independence of K and 
D given Z Bn '(s - 1). 

It remains to bound the last term in (34). Here, if we satisfy 

±jH(K\Z Bn ',fC,hZ) > ±jH(K)-e', (35) 

we have, from (34), that 

R e (s,b) > R s , d -e'. 

Therefore, the secrecy outage event happens once (35) is not satisfied with the given e'. We denote this event as 
follows. 

O(e') 4 ^H(K\Z Bn ' ,h n m ,h n e ) < ±H(K) -ej (36) 
Consequently, we will use the bound 

Pout(s,b,R s , d (e),e') < Pv{0(e')} (37) 

in order to show that the outage probability can be made less than e. 

Following the argument given in [2], one can see that the following key rate can be achieved with perfect secrecy 
(as n' — > oo and B — > oo). 

R s = E[log(l + P{h m )h m ) -R- log(l + P(h m )h e )] + 

with 

^H(K(s l)\Z Bn '(s 1), fC, K) > ^H(K( S 1)) - Cl (38) 

where Z Bn (s - 1) is the received signal by Eve for the super-block s - 1 and e± > is arbitrarily small as 
n',B — ► oo. Here, we denote the number of blocks within the super block s - 1 for which the event O(e') holds 
as (3. Then, from (36) and (38), we conclude that n'e'/3 < n'Bei, which further implies 

Pv{0(e')} = lim | < lim fl. 

At this point, as e\ can be arbitrarily made small as n',B — ► oo, we conclude from (36) that, for any given 
arbitrarily small e' and e 

P OMt (s,6, J R iS!d (e),e / ) < e 

for sufficiently large n' and i?. ■ 
We note that, when only the main CSI is available, we followed the e-achievability notion given by definition 3 
with some arbitrarily small e, which means that the above claimed rate is achievable with perfect secrecy for every 
realization of the channel except for a subset whose probability can be arbitrarily made small. 



July 20, 2009 



DRAFT 



14 



Finally, we report numerical results that validate our theoretical claims. In the full CSI case, we set q(h) = h e 
(hence i?2(h) = 0) and use channel inversion power control policy for the achievable rate. We first set both h m 
and h e to be independent and identically distributed Chi-Square random variables with four degrees of freedom. 
Remarkably, as shown in the upper two curves in Fig. 2, even with these, in general suboptimal, choices of q(h) 
and P(h), the lower and upper bounds coincide in the high SNR regime. The same trend is observed in the lower 
two curves of the figure corresponding to the case with K[h e ] = 2E[h m ). Figure 3 corresponds to the case where 
only the main channel CSI is available at the transmitter. Here, the channel inversion power control policy is used 
for both the upper and lower bounds. The achievability of a non-zero delay limited rate is evident even for the case 
in which the eavesdropper channel is better than the main channel on the average. 

V. Conclusions 

We have studied the delay limited secrecy capacity of the slow-fading channel under different assumptions on 
the transmitter CSI. Our achievability arguments are based on a novel two-stage scheme that allows for overcoming 
the secrecy outage phenomenon for a wide class of channels. The scheme is based on sharing a delay tolerant 
private key, using random binning, and then using the key to encrypt the the delay sensitive packets in a one time 
pad format. For the full CSI case, our scheme is shown to be asymptotically optimal, i.e., at high SNR regime, for 
many relevant channel distributions. When only the main channel CSI is available, the two-stage scheme achieves 
a non-zero delay-limited secure rate, with high probability, for invertible channels. Finally, one can easily identify 
several avenues for future works. For example, 1) obtaining sharp capacity results for finite values of SNR, 2) 
extending the results to multiuser scenarios, 3) characterizing the optimal power control policies, and 4) extending 
the framework to bursty traffic by allowing for buffer delays. 
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Fig. 1. System Model. 
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Fig. 2. Simulation results for the Full CSI. E[/i e ] = E[/i m ] in case 1, and E[/i e ] = 2 E[/i m ] in case 2. 
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Fig. 3. Simulation results for the Main CSI. M[h e ] = K[h m ] in case 1, and E[/i e ] = 2 E[h m ] in case 2. 
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